Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arbitrary Code Execution in eslint-utils CVE-2019-15657, GHSA-3gx7-xhv7-5mx3 | Critical | 2.3% | 26 Aug, 2019 | npm eslint-utils |
Prototype Pollution in deeply CVE-2019-10750, GHSA-8j4w-5fw4-rm27 | Critical | 1.7% | 23 Aug, 2019 | npm deeply |
Prototype Pollution in set-value CVE-2019-10747, GHSA-4g88-fppr-53pp, SNYK-JS-SETVALUE-450213 | Critical | 2.5% | 23 Aug, 2019 | npm set-value |
Prototype Pollution in mixin-deep CVE-2019-10746, GHSA-fhjf-83wg-r2j9, SNYK-JS-MIXINDEEP-450212 | Critical | 3.7% | 23 Aug, 2019 | npm mixin-deep |
Identity Spoofing in libp2p-secio GHSA-rch7-f4h5-x9rj | Critical | Not scored | 23 Aug, 2019 | npm libp2p-secio |
Prototype Pollution in lodash CVE-2019-10744, GHSA-jf85-cpcp-j695, SNYK-JS-LODASH-450202 | Critical | 5.0% | 10 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es +1 more |
Command Injection in open GHSA-28xh-wpgr-7fm8 | Critical | Not scored | 20 Jun, 2019 | npm open |
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople GHSA-4vmm-mhcq-4x9j | Critical | Not scored | 14 Jun, 2019 | npm constantinople |
Failure to sanitize quotes which can lead to sql injection in squel GHSA-4qhx-g9wp-g9m6 | Critical | Not scored | 14 Jun, 2019 | npm squel |
SQL Injection in typeorm GHSA-w7q7-vjp8-7jv4 | Critical | Not scored | 06 Jun, 2019 | npm typeorm |
Sensitive Data Exposure in pem GHSA-pgcr-7wm4-mcv6 | Critical | Not scored | 04 Jun, 2019 | npm pem |
Command Injection in command-exists GHSA-cff4-rrq6-h78w | Critical | Not scored | 03 Jun, 2019 | npm command-exists |
Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js CVE-2017-11429, GHSA-5p5w-j3g7-w4wv | Critical | 2.7% | 17 Apr, 2019 | npm saml2-js |
OS Command Injection in node-opencv CVE-2019-10061, GHSA-mc7w-4cjf-c973 | Critical | 4.2% | 26 Mar, 2019 | npm opencv |
Code Injection in morgan CVE-2019-5413, GHSA-gwg9-rgvj-4h5j | Critical | 3.4% | 21 Mar, 2019 | npm morgan |
irisnet-crypto RCE Vulnerability CVE-2019-9115, GHSA-5fh8-x9xc-hxmc | Critical | 2.3% | 25 Feb, 2019 | npm irisnet-crypto |
Critical severity vulnerability that affects Haraka CVE-2016-1000282, GHSA-w5m8-5v9m-xhx5 | Critical | 13.5% | 05 Feb, 2019 | npm Haraka |
Prototype Pollution in extend CVE-2018-16492, GHSA-qrmc-fj45-qfc2 | Critical | 3.0% | 01 Feb, 2019 | npm extend |
Prototype Pollution in node.extend CVE-2018-16491, GHSA-r96c-57pf-9jjm | Critical | 1.7% | 01 Feb, 2019 | npm node.extend |
Prototype Pollution in just-extend CVE-2018-16489, GHSA-675m-85rw-j3w4 | Critical | 1.8% | 01 Feb, 2019 | npm just-extend |
Prototype Pollution in defaults-deep CVE-2018-16486, GHSA-pjxw-22xf-6pwc | Critical | 1.5% | 01 Feb, 2019 | npm defaults-deep |
Nuclide Improper Input Validation CVE-2018-6333, GHSA-r83x-wj75-v89r | Critical | 2.3% | 31 Dec, 2018 | npm nuclide |
react-dev-utils on Windows vulnerable to Remote Code Execution CVE-2018-6342, GHSA-29gp-92wp-94q8 | Critical | 2.8% | 31 Dec, 2018 | npm react-dev-utils |
Critical severity vulnerability that affects event-stream and flatmap-stream GHSA-mh6f-8j2x-4483 | Critical | Not scored | 26 Nov, 2018 | npm event-stream npm flatmap-stream |
Unrestricted Upload of File with Dangerous Type in jquery-file-upload CVE-2018-9207, GHSA-mxr5-p36v-479m | Critical | 3.5% | 19 Nov, 2018 | npm jquery-file-upload |
Command Injection in apex-publish-static-files CVE-2018-16462, GHSA-9jm3-5835-537m | Critical | 7.0% | 30 Oct, 2018 | npm apex-publish-static-files |
Command Injection in libnmap CVE-2018-16461, GHSA-7g2w-6r25-2j7p | Critical | 3.9% | 30 Oct, 2018 | npm libnmap |
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload CVE-2018-9206, GHSA-4cj8-g9cp-v5wr | Critical | 97.3% | 11 Oct, 2018 | npm blueimp-file-upload |
ps Enables OS Command Injection CVE-2018-16460, GHSA-cfhg-9x44-78h2 | Critical | 2.9% | 07 Sep, 2018 | npm ps |
Command Injection in egg-scripts CVE-2018-3786, GHSA-c9j3-wqph-5xx9 | Critical | 12.3% | 24 Aug, 2018 | npm egg-scripts |
dojox vulnerable to unescaped string injection CVE-2018-15494, GHSA-84cm-x2q5-8225 | Critical | 2.5% | 18 Aug, 2018 | npm dojox |
Command Injection in git-dummy-commit CVE-2018-3785, GHSA-h3c2-x77c-7pvr | Critical | 4.0% | 17 Aug, 2018 | npm git-dummy-commit |
Code Injection in cryo CVE-2018-3784, GHSA-38f5-ghc2-fcmv | Critical | 3.3% | 17 Aug, 2018 | npm cryo |
Privilege Escalation due to Blind NoSQL Injection in flintcms CVE-2018-3783, GHSA-jhq3-57xh-6643 | Critical | 3.8% | 17 Aug, 2018 | npm flintcms |
Open Redirect in url-parse CVE-2018-3774, GHSA-pv4c-p2j5-38j4 | Critical | 3.8% | 12 Aug, 2018 | npm url-parse |
Command Injection in whereis CVE-2018-3772, GHSA-wjr4-2jgw-hmv8 | Critical | 2.8% | 30 Jul, 2018 | npm whereis |
Malicious Package in eslint-scope GHSA-hxxf-q3w9-4xgw | Critical | Not scored | 12 Jul, 2018 | npm eslint-config-eslint npm eslint-scope |
Sensitive Data Exposure in msrcrypto CVE-2018-8319, GHSA-qg3g-2mgh-33j8 | Critical | 7.7% | 11 Jul, 2018 | npm msrcrypto |
Command Injection in macaddress CVE-2018-13797, GHSA-pp57-mqmh-44h7 | Critical | 6.7% | 10 Jul, 2018 | npm macaddress |
Insufficient Entropy in cryptiles CVE-2018-1000620, GHSA-rq8g-5pc5-wrhr | Critical | 1.7% | 09 Jul, 2018 | npm cryptiles |
Denial of Service in memjs CVE-2018-3767, GHSA-cx8m-8xmx-q8v3 | Critical | 1.5% | 05 Jul, 2018 | npm memjs |
Prototype Pollution in async merge-object CVE-2018-3753, GHSA-fp82-2h99-3fpp | Critical | 1.4% | 03 Jul, 2018 | npm merge-object |
Prototype Pollution in merge-options CVE-2018-3752, GHSA-qw93-45r3-p66p | Critical | 1.4% | 03 Jul, 2018 | npm merge-options |
Prototype Pollution in merge-recursive CVE-2018-3751, GHSA-cvxm-f295-x957 | Critical | 1.4% | 03 Jul, 2018 | npm merge-recursive |
Prototype Pollution in deep-extend CVE-2018-3750, GHSA-hr2v-3952-633q | Critical | 2.1% | 03 Jul, 2018 | npm deep-extend |
Improper Input Validation in Deap CVE-2018-3749, GHSA-xg47-r67p-vhv5 | Critical | 1.4% | 03 Jul, 2018 | npm deap |
Denial of Service in https-proxy-agent CVE-2018-3739, GHSA-8g7p-74h8-hg48 | Critical | 1.7% | 07 Jun, 2018 | npm https-proxy-agent |
Sandbox Breakout / Arbitrary Code Execution in static-eval CVE-2017-16226, GHSA-5mjw-6jrh-hvfq | Critical | 3.5% | 07 Jun, 2018 | npm static-eval |
Chromium Remote Code Execution in electron CVE-2017-16151, GHSA-4w88-rjj3-x7wp | Critical | 2.7% | 07 Jun, 2018 | npm electron |
npm-script-demo is malware CVE-2017-16128, GHSA-322m-p39j-r5m2 | Critical | 1.4% | 07 Jun, 2018 | npm npm-script-demo |